论文标题
（认证！！）免费的对抗性鲁棒性！
(Certified!!) Adversarial Robustness for Free!
论文作者
论文摘要
在本文中，我们展示了如何通过仅依靠现成的预审预周仔的模型来实现对2型界限的最先进的对抗性鲁棒性。为此，我们实例化了Salman等人的Denoceed平滑方法。 2020年结合预处理的脱糖性扩散概率模型和标准的高精度分类器。这使我们能够在限制的对抗扰动下证明ImageNet上的71％精度在2个标准内，使用任何方法比先前的认证SOTA提高了14个百分点，或改善了比固定平滑的30个百分点。我们仅使用验证的扩散模型和图像分类器获得这些结果，而无需进行任何模型参数的微调或重新培训。
In this paper we show how to achieve state-of-the-art certified adversarial robustness to 2-norm bounded perturbations by relying exclusively on off-the-shelf pretrained models. To do so, we instantiate the denoised smoothing approach of Salman et al. 2020 by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classifier. This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within an 2-norm of 0.5, an improvement of 14 percentage points over the prior certified SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.
